|Skip Navigation Links|
|Exit Print View|
|System Administration Guide: Security Services Oracle Solaris 11 Express 11/10|
When a user is directly assigned privileges, the privileges are in effect in every shell. When a user is not directly assigned privileges, then the user must open a profile shell. For example, when commands with assigned privileges are in a rights profile that is in the user's list of rights profiles, then the user must execute the command in a profile shell.
The following procedure shows how to determine if you have been directly assigned privileges.
Caution - Inappropriate use of directly assigned privileges can result in unintentional breaches of security. For a discussion, see Security Considerations When Directly Assigning Security Attributes.
See How to Determine the Privileges on a Process for the procedure.
The privileges that are listed in the effective set are in effect throughout your session. If you have been directly assigned privileges in addition to the basic set, the privileges are listed in the effective set.
Example 11-8 Determining Your Directly-Assigned Privileges
If you have been directly assigned privileges, then your basic set contains more than the default basic set. In this example, the user always has access to the proc_clock_highres privilege.
% /usr/ucb/whoami jdoe % ppriv -v $$ 1800: pfksh flags = <none> E: file_link_any,…,proc_clock_highres,proc_session I: file_link_any,…,proc_clock_highres,proc_session P: file_link_any,…,proc_clock_highres,proc_session L: cpc_cpu,dtrace_kernel,dtrace_proc,dtrace_user,…,sys_time % ppriv -vl proc_clock_highres Allows a process to use high resolution timers.
Example 11-9 Determining a Role's Directly-Assigned Privileges
Roles use an administrative shell, or profile shell. Users who assume a role can use the role's shell to list the privileges that have been directly assigned to the role. In the following example, the role realtime has been directly assigned privileges to handle date and time programs.
% su - realtime Password: <Type realtime password> $ /usr/ucb/whoami realtime $ ppriv -v $$ 1600: pfksh flags = <none> E: file_link_any,…,proc_clock_highres,proc_session,sys_time I: file_link_any,…,proc_clock_highres,proc_session,sys_time P: file_link_any,…,proc_clock_highres,proc_session,sys_time L: cpc_cpu,dtrace_kernel,dtrace_proc,dtrace_user,…,sys_time
When a user is not directly assigned privileges, then the user gets access to privileged commands through a rights profile. Commands in a rights profile must be executed in a profile shell.
% profiles $ profiles Audit Review Console User Suspend To RAM Suspend To Disk Brightness CPU Power Management Network Autoconf Desktop Print Management Network Wifi Info Desktop Removable Media User Basic Solaris User All
profiles -l Audit Review solaris.audit.read /usr/sbin/auditreduce euid=0 /usr/sbin/auditstat euid=0 /usr/sbin/praudit euid=0
The Audit Review rights profile enables you to run the auditreduce, auditstat, and praudit commands with the effective UID of 0, and assigns you the solaris.audit.read authorization.
Example 11-10 Running Privileged Commands in a Profile Shell
In the following example, the user jdoe cannot change the group permissions on a file from his regular shell. However, jdoe can change the permissions when typing the command in a profile shell.
% whoami jdoe % ls -l useful.script -rwxr-xr-- 1 nodoe eng 262 Apr 2 10:52 useful.script chgrp staff useful.script chgrp: useful.script: Not owner % pfksh $ /usr/ucb/whoami jdoe $ chgrp staff useful.script $ chown jdoe useful.script $ ls -l useful.script -rwxr-xr-- 1 jdoe staff 262 Apr 2 10:53 useful.script
A role gets access to privileged commands through a rights profile that contains commands with assigned privileges. The most secure way to provide a user with access to privileged commands is to assign a role to them. After assuming the role, the user can execute all the privileged commands that are included in the rights profiles for that role.
% roles root
If your role is root, and no administrator has reconfigured the role, you have all the rights of the root user.
% su - devadmin Enter password: Type devadmin password $ whoami devadmin $ profiles Device Security
Example 11-11 Running the Privileged Commands in Your Role
When a user assumes a role, the shell becomes a profile shell. Therefore, the commands are executed with the privileges that were assigned to the commands. In the following example, the admin role can change the permissions on the useful.script file.
% whoami jdoe % ls -l useful.script -rwxr-xr-- 1 elsee eng 262 Apr 2 10:52 useful.script chgrp admin useful.script chgrp: useful.script: Not owner % su - admin Password: <Type admin password> $ /usr/ucb/whoami admin $ chgrp admin useful.script $ chown admin useful.script $ ls -l useful.script -rwxr-xr-- 1 admin admin 262 Apr 2 10:53 useful.script